Skip to content
Snippets Groups Projects
Select Git revision
  • experimental
  • master
  • v2021.1.2-ffs
  • v2021.1.1-ffs
  • nrb/gluon-master-cpe510
  • v2021.1-ffs
  • v2020.2.3-ffs
  • nrbffs/fastd-remove-delay
  • v2020.2.2-ffs
  • v2020.2.1-ffs
  • v2020.2-ffs
  • v2020.2.x
  • v2020.1.3-ffs
  • v2020.1.1-ffs
  • v2020.1-ffs
  • v2019.1.2-ffs
  • v2019.1.1-ffs
  • nrb/test-radv-filter
  • v2019.1-ffs
  • nrbffs/netgear-ex6120
  • v2021.1.2-ffs0.2
  • v2021.1.2-ffs0.1
  • v2021.1.1-ffs0.4
  • v2021.1.1-ffs0.3
  • v2021.1.1-ffs0.2
  • v2021.1.1-ffs0.1
  • v2021.1-ffs0.1
  • v2020.2.3-ffs0.3
  • v2020.2.3-ffs0.2
  • v2020.2.3-ffs0.1
  • v2020.2.2-ffs0.1
  • v2020.2.1-ffs0.1
  • v2020.2-ffs0.1
  • v2020.2
  • v2020.2.x-ffs0.1
  • v2020.1.3-ffs0.1
  • v2020.1.1-ffs0.1
  • v2020.1-ffs0.1
  • v2019.1.2-ffs0.1
  • v2019.1.1-ffs0.1
40 results

gluon

  • Clone with SSH
  • Clone with HTTPS
  • Forked from firmware / FFS Gluon
    Source project has a limited visibility.
    user avatar
    Matthias Schiffer authored
    The autoupdater supports HTTPS when a ustream TLS backend is installed,
    but we did not allow this in site.conf. However, just allowing HTTPS
    URLs unconditionally is also a bad idea, as it might result in nodes
    being unable to reach the mirror, in particular if the `tls` feature is
    enabled only for some devices.
    
    Solve this by allowing https:// URLs only if the marker file installed
    by gluon-tls is found, failing the site check with an error message like
    the following otherwise:
    
        *** All of the following alternatives have failed:
            1) site.conf error: expected autoupdater.branches.test.mirrors.1 to match pattern 'http://', but it is "https://..." (a string value)
            2) site.conf error: expected autoupdater.branches.test.mirrors.1 to use HTTPS only if the 'tls' feature is enabled, but it is "https://..." (a string value)
            3) site.conf error: expected autoupdater.branches.test.mirrors.1 to match pattern '^//', but it is "https://..." (a string value)
    
    In addition, introduce support for protocol-less //server/path URLs,
    which will use either HTTP or HTTPS depending on the availablility of
    the `tls` feature. No fallback happens when `tls` is available, but the
    HTTPS connection fails, preventing downgrade attack.
    
    Based-on-patch-by: default avatarKevin Olbrich <ko@sv01.de>
    c800fe7f
    History
    Name Last commit Last update